With a little heads-up: "Wildcard identifiers may only be authorized by DNS-01 challenge" (which makes perfectly sense for wildcards)